[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpLwHDO4a1T6b87se1S0n92ftiFC3tzzW9iXeH2vxwtM":3},{"article":4,"iocs":46,"watch_terms":50,"solutions":51,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"b94519ab-9d5c-4778-8687-9cfd21381596","New macOS malware embeds fake errors to confuse AI analysis tools","new-macos-malware-embeds-fake-errors-to-confuse-ai-analysis-tools-9666d4","A newly discovered macOS malware dubbed \"Gaslight\" is designed to confuse AI-assisted malware analysis tools by hiding prompt injection strings and fake debugging data within the executable. [...]","A new macOS malware named 'Gaslight' has been discovered, designed to evade AI-assisted analysis tools by embedding fake system error messages and prompt injection strings within its executable. The malware, attributed to a North Korean-linked threat actor, aims to confuse AI models into aborting or misinterpreting the analysis, rather than bypassing sandbox execution.","New macOS malware 'Gaslight' uses fake errors to confuse AI analysis tools.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-macos-malware-embeds-fake-errors-to-confuse-ai-analysis-tools\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F02\u002F11\u002Fai-extract.jpg","2026-06-25T16:23:19+00:00","2026-06-25T18:00:31.469841+00:00",8,[17,20],{"name":18,"type":19},"North Korean-linked threat actor","threat_actor",{"name":21,"type":22},"macOS","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":27,"value":48,"context":49},"Gaslight","Name of the new macOS malware family",[21],{"controls":52,"vendors":130},[53,82,107],{"slug":54,"name":55,"problem":56,"products":57},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":38,"name":83,"problem":84,"products":85},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[86,91,99],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":87,"product_name":88,"url":89,"description":90},"prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"slug":108,"name":109,"problem":110,"products":111},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[112,117,124],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":113,"product_name":114,"url":115,"description":116},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":108,"product_name":121,"url":122,"description":123},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":126,"url":128,"description":129},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[131,137],{"slug":132,"name":133,"logo_path":134,"roles":135},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[136],"affected",{"slug":138,"name":139,"logo_path":140,"roles":141},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png",[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":157},"macos-malware-gaslight-weaponizes-ai-confusion-to-evade-analysis","macOS Malware 'Gaslight' Weaponizes AI Confusion to Evade Analysis","The 'Gaslight' malware, linked to North Korean threat actors, exploits a novel attack surface: the AI-assisted analysis tools defenders rely on to triage and understand malware behavior. By embedding fake system error messages and prompt injection strings directly into its executable, the malware manipulates AI models into misinterpreting or abandoning analysis entirely. This represents a significant evolution in adversarial tradecraft — attackers are no longer just evading sandboxes or antivirus signatures, but actively subverting the AI-augmented workflows of security analysts. It matters because as organizations increasingly trust AI tools to accelerate threat detection and response, those tools themselves become high-value targets for manipulation.",[148,149,150,151,152,153,154,155,156],"NIST CSF DE.CM-4 (Malicious code is detected)","NIST SP 800-183 (Networks of Things \u002F AI pipeline integrity)","NIST AI RMF - Govern 1.2 (Adversarial ML risks)","CIS Control 10: Malware Defenses","CIS Control 17: Incident Response Management","MITRE ATT&CK T1027 (Obfuscated Files or Information)","MITRE ATLAS AML.T0054 (Prompt Injection)","NIST SP 800-61r2: Computer Security Incident Handling Guide","ISO\u002FIEC 27001 A.12.2 (Protection from malware)",{}]